sessions: unlog inactive users (#42428)

tests/test_sessions.py

@@ -208,3 +208,11 @@ def test_session_clean_job(pub, user, app, freezer):
     freezer.move_to(datetime.datetime.now() + datetime.timedelta(5))  # last usage limit
     pub.clean_sessions()
     assert pub.session_manager.session_class.count() == 0
+
+
+def test_inactive_user(pub, user, app):
+    login(app, username='foo', password='foo')
+    assert 'Logout' in app.get('/')
+    user.is_active = False
+    user.store()
+    assert 'Logout' not in app.get('/')

wcs/qommon/sessions.py

@@ -215,12 +215,13 @@ class Session(QommonSession, CaptchaSession, StorableObject):
                 user.anonymous = True
                 user.name_identifiers = [ self.name_identifier ]
                 user.lasso_dump = self.lasso_anonymous_identity_dump
-                return user
             else:
                 try:
-                    return get_publisher().user_class.get(user_id)
+                    user = get_publisher().user_class.get(user_id)
                 except KeyError:
-                    pass
+                    return None
+            if user.is_active:
+                return user
         return None
 
     def set_user(self, user_id):